Cryptographic method for group signature

Abstract

A cryptographic method for signing a message m by a user device on behalf of a group managed by a group manager, which has a secret key generated from two variates x and y, the group having a public key formed from a plurality of elements comprising an element g and an element gz pertaining to a cyclic group of order p, p being a whole prime number and z a variate, and an element h, an element hx, an element h 1 /z and an element hy/z pertaining to a cyclic group of order p. The method includes: receiving a certificate from the group manager, including elements S 1= gr, S 2= gr(x+y.u) and S 3= gz.r where r is a variate selected by the group manager for the user device; and generating a group signature for the message m, based on the certificate, a variate t generated by the user device, and the secret u.

The invention claimed is: 
     
       1. A cryptographic method comprising:
 signing a message m, by a user device, on behalf of a group, said group being managed by a group manager having a secret key generated from two variates x and y, said group having a public key formed by a plurality of elements comprising an element g and an element g z  belonging to a cyclic group G 1  of order p, p designating a prime integer and z a variate, and an element h, an element h x , an element h  1/z  and an element h y/z  belonging to a cyclic group G 2  of order p, said signing comprising:
 receiving, after having proved to the manager of the group knowledge of a secret u selected by the user device, a certificate C provided by the manager of the group comprising an element S 1 =g r , an element S 2 =g r(x+y.u)  and an element S 3 =g z.r  where r designates a variate selected by the manager of the group for said user device; and 
 generating a group signature for the message m, from the certificate provided by the manager of the group, a variate t generated by the user device, and the secret u, said generated group signature comprising an element T 1 =S 1   t , an element T 2 =(S 2 .S 1   u.m ) t  and an element T 3 =S 3   ut . 
 
 
     
     
       2. The cryptographic method according to  claim 1  comprising calculating an element S 3 ′ from the element S 3  of the certificate provided by the manager of the group by elevating the element S 3  to the power u, said element T 3  being calculated during the step of generating the signature by elevating the element S 3 ′ calculated during the step of calculating to the power t. 
     
     
       3. The cryptographic method according to  claim 1  wherein the secret key of the manager of the group is formed from the variates x and y and wherein, to prove knowledge of the secret u to the manager of the group, the user device sends the element g u  to the manager of the group. 
     
     
       4. The cryptographic method according to  claim 1  wherein the secret key of the group manager is formed from the elements g x  and g y  and wherein, to prove knowledge of the secret u to the manager of the group, the user device:
 receives the element g y  from the manager of the group; and 
 calculates and sends the element (g y ) u  to the manager of the group. 
 
     
     
       5. The cryptographic method according to  claim 1  wherein the user device proves knowledge of the secret u to the manager of the group by using the Schnorr algorithm. 
     
     
       6. The cryptographic method according to  claim 1  comprising:
 verifying by a verification device the group signature comprising the elements T 1 , T 2  and T 3 , and generated for the message m by the user device, said verifying comprising:
 verifying the equality e(T 2 ,h)=e(T 1 ,X).e(T 3 ,Y′.Z′ m ), where e designates a bilinear coupling defined on the cyclic groups G 1  and G 2  and having values in the cyclic group GT; and 
 in response to said equality being verified, validating the group signature. 
 
 
     
     
       7. A cryptographic method comprising:
 providing a certificate by a manager device of a group to a user device joining the group, said group manager device having a secret key generated from two variates x and y, said group having a public key formed by a plurality of elements comprising an element g and an element g z  belonging to a cyclic group G 1  of order p, p designating a prime integer and z a variat, and an element h, an element h x , an element h 1/z  and an element h y/z  belonging to a cyclic group G 2  of order p, said providing comprising: 
 
       obtaining, originating from the user device, proof of knowledge by said user device of a secret u selected by the user device; 
       selecting a variate r for the user device; 
       generating a certificate for the user device comprising an element S 1 =g r , an element S 2 =g r(x+y.u)  and an element S 3 =g z.r;  and 
       sending the generated certificate to the user device. 
     
     
       8. A user device capable of signing a message m on behalf of a group, said group being managed by a group manager having a secret key generated from two variates x and y, said group having a public key formed by a plurality of elements comprising an element g and an element g z  belonging to a cyclic group G 1  of order p, p designating a prime integer and z a variate, and an element h, an element h x , an element h 1/z  and an element h y/z  belonging to a cyclic group G 2  of order p, said user device comprising:
 a processor; and 
 a non-transitory computer-readable medium comprising instructions which when executed by a processor of the user device, configure the user device to:
 select a secret u; 
 a prove knowledge of the secret u to the manager of the group; 
 receive, after the user device has proved to the manager of the group knowledge of the secret u, a certificate C provided by the manager of the group comprising an element S 1 =g r , an element S 2 =g r(x+y.u)  and an element S 3 =g z.r  where r designates a variate selected by the manager of the group for said user device; and 
 generate a group signature for the message m, from the certificate provided by the manager of the group, a variate t generated by the user device, and the secret u, said generated group signature comprising an element T 1 =S 1   t , an element T 2 =(S 2 .S 1   u.m ) t  and an element T 3 =S 3   ut .